Omanghana
The Cyber Security Experts Association of Ghana has warned organizations to urgently review their web infrastructure following the discovery of critical security flaws in PHP, a widely used programming language.
According to the association, an assessment of 25 Ghanaian government websites found that 22 were built using PHP. The finding highlights the importance of checking their security status, although the use of PHP alone does not establish that a website is vulnerable or has been compromised.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve weaknesses in PHP’s handling of memory and internal request data. They could allow attackers to execute code remotely without logging in, potentially exposing affected servers and the information they hold. Both received a critical severity rating of 9.2 out of 10. php.net
The warning places particular pressure on institutions responsible for public-facing services and sensitive records to establish whether their systems require updates. Website administrators and hosting providers will need to confirm the PHP versions in use and whether the relevant fixes have been installed.
The PHP development team released security updates on October 21, 2026, covering versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its advisory urges users to update immediately and directs organizations using vendor-managed packages to obtain the appropriate fixes from their providers. php.net
Older installations also require attention. PHP 8.1 and earlier versions no longer receive regular updates from the project, although some vendors offer backported security fixes. Organizations running those versions should confirm vendor support or move to a supported release.
The developers caution that temporary measures can reduce exposure to particular attack methods but do not fully secure an affected installation. Applying the security updates remains the complete solution to the two vulnerabilities. php.net
For Ghanaian institutions, the association’s assessment underscores the need to establish the status of each website promptly and coordinate remediation with the teams responsible for hosting and maintenance.
Source: Omanghana
